CWE-200, Exposure of Sensitive Information to an Unauthorized Actor, is the broad class for software that reveals information to someone who is not supposed to have it. The class is wide on purpose. It covers a debug log that prints a token, an error page that names a database, a response that includes a field it should not, and a login form that tells you whether a username exists.
Almost every application can hit it, which is why MITRE keeps it as a class and not a single bug.
How it happens
MITRE's extended description lists the kinds of information involved:
- Private or personal data such as messages, financial data, health records, location and contact details.
- System status and environment, such as the operating system and installed packages.
- Business secrets and intellectual property.
- Network status and configuration.
- The product's own code or internal state.
- Metadata, such as connection logs or message headers.
- Indirect information, such as a discrepancy between two internal operations that an outsider can observe.
The same information can matter to different parties: the product's users, people whose data the product handles even if they are not users, administrators, and the developer. Each has their own expectation of what stays private.
MITRE's observed examples show the range:
- CVE-2022-31162: a Rust library leaked OAuth client details in application debug logs.
- CVE-2021-25476: a digital rights management capability on a mobile platform leaked pointer information, which made it easier to bypass ASLR.
- CVE-2001-1483: enumeration of valid usernames based on inconsistent responses.
- CVE-2001-1528: account number enumeration through inconsistent responses.
A small code example of the username case:
# Vulnerable: different messages reveal which accounts exist
def login(user, pw):
acct = db.find(user)
if acct is None:
return "No such user"
if not check(acct, pw):
return "Wrong password"
# Fixed: same answer either way
def login(user, pw):
acct = db.find(user)
if acct is None or not check(acct, pw):
return "Invalid username or password"
Timing and response size can leak the same fact, so make the work done on both paths as similar as you can.
What an attacker gains
MITRE lists confidentiality impact: the ability to read application data. The practical value depends on what leaks. A username list feeds password guessing. A leaked pointer weakens a memory defense. A leaked credential gives access directly.
How to find it
MITRE's listed techniques include:
- Automated static analysis of binary or bytecode, with inter-application flow analysis.
- Dynamic analysis with automated results interpretation, where web application scanners, web services scanners and database scanners are rated highly cost effective.
- Dynamic analysis with manual interpretation, such as fuzz testers and monitored execution.
- Manual source code review, rated highly cost effective.
Add simple checks of your own. Read your logs as an outsider would. Trigger errors and read the responses. Compare responses for valid and invalid accounts. Look at API payloads and ask whether the client needs every field.
Secrets that end up in repositories are one common route to exposure, and a scan can catch them early.
Click through it at your own pace, or open it full screen.
How to fix it
The record lists no mitigations, so these are general steps.
- Decide what is sensitive and who may see it. Write it down per data type.
- Return only the fields a caller needs. Build response objects from an allowlist.
- Use generic error messages for users and put the detail in a protected log.
- Keep secrets, tokens and personal data out of logs, or mask them.
- Make success and failure responses indistinguishable where the difference would help an attacker, including timing.
- Review third party libraries for logging behavior, since a dependency can leak just as your own code can. The free scan at gold.safeguard.sh/scan runs in your browser with no login, keeps the file on your machine and handles up to 100 dependencies.
Quick check
Why is "user not found" a leak?
It tells an attacker which usernames are valid, so they can focus guessing on real accounts.
Is this only about passwords and keys?
No. MITRE includes system details, internal state, metadata and indirect signals, such as differences in behavior.
